IoCs available here. Some of them with no detection on VT.
Of course, in the end it is just conflict, and when it spills over into the real world then you have a war. But this is not always the case We have already had disruption in power grids, nuclear plants, hospitals, public offices, critical infrastructure of financial markets (some of them with impact in real lives) without retaliation in the physical world.
Cyberwar, in my perspective, have some nuances. For instance, in a physical conflict, a hostile nation’s invasion of my property immediately becomes a state issue. However, this isn’t always the case in a cyberwar if a hostile state invades my organization (It’s hard to immediately distinguish whether the actor is a nation state, a financially motivated group, hacktivists, or just a guy who eats pizza in his mom’s basement). Most of the time, organizations are on their own.
In a cyberwar, espionage is also far more acceptable. This is something the NSA (and FSB/SVR) has been doing for years (against private entities and states). In a way, I understand that it is something similar to what the cold war was (is), but with no boots on the ground.
From the article:
Microsoft locked down a server last month that exposed Microsoft employee passwords, keys and credentials to the open Internet, as the company faces growing pressure to strengthen the security of its software. Microsoft was notified of the vulnerability on February 6th and the block on March 5th. It is unclear whether anyone accessed the exposed server during this period.
In this particular case, the method of infection of the router was not disclosed. However, typically, the most common methods involve an open administration port to the internet (user interface or TR-069) or through the internal interface, in case a network host has been compromised.
They often perform brute-force password attacks, and once access is obtained, they look for typical Linux administrative tools (such as bash, etc.) and proceed to compromise the router.
So I understand that a router with custom firmware can be compromised if it has a weak password and resources to maintain the infection, or of course, a vulnerability that is exploitable.
IoCs from original research:
Hashes
267071df79927abd1e57f57106924dd8a68e1c4ed74e7b69403cdcdf6e6a453b 54/70
d6ac21a409f35a80ba9ccfe58ae1ae32883e44ecc724e4ae8289e7465ab2cf40 54/71
ad4d196b3d85d982343f32d52bffc6ebfeec7bf30553fa441fd7c3ae495075fc
13c017cb706ef869c061078048e550dba1613c0f2e8f2e409d97a1c0d9949346
b376a3a6bae73840e70b2fa3df99d881def9250b42b6b8b0458d0445ddfbc044
Domains
hanagram[.]jpthefinetreats[.]com
caduff-sa[.]chjeepcarlease[.]com
buy-new-car[.]com
carleasingguru[.]com
IP Addresses
91[.]193[.]18[.]120
IoCs:
IOCs Hashes (SHA-256) Email – 16e6dfd67d5049ffedb8c55bee6ad80fc0283757bc60d4f12c56675b1da5bf61
Docx – 1abf56bc5fbf84805ed0fbf28e7f986c7bb2833972793252f3e358b13b638bb1
Injected ZIP – 95898c9abce738ca53e44290f4d4aa4e8486398de3163e3482f510633d50ee6c
LNK file – d07323226c7be1a38ffd8716bc7d77bdb226b81fd6ccd493c55b2711014c0188
Final ZIP – 94499196a62341b4f1cd10f3e1ba6003d0c4db66c1eb0d1b7e66b7eb4f2b67b6 26/64
Client32.exe – 89f0c8f170fe9ea28b1056517160e92e2d7d4e8aa81f4ed696932230413a6ce1 26/73
URLs and Hostnames yourownmart[.]com/solar[.]txt
firstieragency[.]com/depbrndksokkkdkxoqnazneifidmyyjdpji[.]txt
yourownmart[.]com
firstieragency[.]com
parabmasale[.]com
tapouttv28[.]com
IP Addresses 192[.]236[.]192[.]48
173[.]252[.]167[.]50
199[.]188[.]205[.]15
46[.]105[.]141[.]54
Others Message ID contains: “sendinblue[.]com”
Return Path contains: “sender-sib[.]com”
For the IoCs, check the original research.
From the text:
Now, attackers breach a user’s mobile account with stolen, brute-forced, or leaked credentials and initiate porting the victim’s number to another device on their own. They can do this by generating a QR code through the hijacked mobile account that can be used to activate a new eSIM. They then scan it with their device, essentially hijacking the number.
No need for social engineering.
IOCs from the article :
Type Value Description
IP 91.92.240[.]113 Magnet Goblin Infra
IP 45.9.149[.]215 Magnet Goblin Infra
IP 94.156.71[.]115 Magnet Goblin Infra
URL http://91.92.240[.]113/auth.js Magnet Goblin Infra
URL http://91.92.240[.]113/login.cgi Magnet Goblin Infra
URL http://91.92.240[.]113/aparche2 Magnet Goblin Infra
URL http://91.92.240[.]113/agent Magnet Goblin Infra
URL http://45.9.149[.]215/aparche2 Magnet Goblin Infra
URL http://45.9.149[.]215/agent Magnet Goblin Infra
URL http://94.156.71[.]115/lxrt Magnet Goblin Infra
URL http://94.156.71[.]115/agent Magnet Goblin Infra
URL http://94.156.71[.]115/instali.ps1 Magnet Goblin Infra
URL http://94.156.71[.]115/ligocert.dat Magnet Goblin Infra
URL http://94.156.71[.]115/angel.dat Magnet Goblin Infra
URL http://94.156.71[.]115/windows.xml Magnet Goblin Infra
URL http://94.156.71[.]115/instal1.ps1 Magnet Goblin Infra
URL http://94.156.71[.]115/Maintenance.ps1 Magnet Goblin Infra
URL http://94.156.71[.]115/baba.dat Magnet Goblin Infra
URL **http://**oncloud-analytics[.]com/files/mg/elf/RT1.50.png Magnet Goblin Infra
URL http://cloudflareaddons[.]com/assets/img/Image_Slider15.1.png Magnet Goblin Infra
Domain mailchimp-addons[.]com MiniNerbian C2
Domain allsecurehosting[.]com MiniNerbian C2
Domain dev-clientservice[.]com MiniNerbian C2
Domain oncloud-analytics[.]com MiniNerbian C2
Domain cloudflareaddons[.]com MiniNerbian C2
Domain textsmsonline[.]com MiniNerbian C2
Domain proreceive[.]com MiniNerbian C2
IP 172.86.66[.]165 NerbianRAT C2
IP 45.153.240[.]73 NerbianRAT C2
SHA256 027d03679f7279a2c505f0677568972d30bc27daf43033a463fafeee0d7234f6 NerbianRAT
SHA256 9cb6dc863e56316364c7c1e51f74ca991d734dacef9029337ddec5ca684c1106 NerbianRAT
SHA256 9d11c3cf10b20ff5b3e541147f9a965a4e66ed863803c54d93ba8a07c4aa7e50 NerbianRAT
SHA256 d3fbae7eb3d38159913c7e9f4c627149df1882b57998c8acaac5904710be2236 MiniNerbian
SHA256 df91410df516e2bddfd3f6815b3b4039bf67a76f20aecabccffb152e5d6975ef MiniNerbian
SHA256 99fd61ba93497214ac56d8a0e65203647a2bc383a2ca2716015b3014a7e0f84d MiniNerbian
SHA256 9ff0dcce930bb690c897260a0c5aaa928955f4ffba080c580c13a32a48037cf7 MiniNerbian
SHA256 3367a4c8bd2bcd0973f3cb22aa2cb3f90ce2125107f9df2935831419444d5276 MiniNerbian
SHA256 f23307f1c286143b974843da20c257901cf4be372ea21d1bb5dea523a7e2785d MiniNerbian
SHA256 f1e7c1fc06bf0ea40986aa20e774d6b85c526c59046c452d98e48fe1e331ee4c MiniNerbian
SHA256 926aeb3fda8142a6de8bc6c26bc00e32abc603c21acd0f9b572ec0484115bb89 MiniNerbian
SHA256 894ab5d563172787b052f3fea17bf7d51ca8e015b0f873a893af17f47b358efe MiniNerbian
SHA256 1079e1b6e016b070ebf3e1357fa23313dcb805d3a6805088dbc3ab6d39330548 WARPWIRE
SHA256 e134e053a80303d1fde769e50c2557ade0852fa827bed9199e52f67bac0d9efc WARPWIRE
URL www.fernandestechnical[.]com/pub/health_check.php Compromised Server
URL biondocenere[.]com/pub/health_check.php Compromised Server
URL ****www.miltonhouse[.]nl/pub/opt/processor.php Compromised Server
URL https://theroots[.]in/pub/media/avatar/223sam.jpg Compromised Server
SHA256 7967def86776f36ab6a663850120c5c70f397dd3834f11ba7a077205d37b117f Other: Tools and scripts
SHA256 9895286973617a79e2b19f2919190a6ec9afc07a9e87af3557f3d76b252292df Other: Tools and scripts
SHA256 bd9edc3bf3d45e3cdf5236e8f8cd57a95ca3b41f61e4cd5c6c0404a83519058e Other: Tools and scripts
SHA256 b35f11d4f54b8941d4f1c5b49101b67b563511a55351e10ad4ede17403529c16 Other: Tools and scripts
SHA256 7b1d1e639d1994c6235d16a7ac583e583687660d7054a2a245dd18f24d10b675 Other: Tools and scripts
SHA256 8fe1ed1e34e8758a92c8d024d73c434665a03e94e5eb972c68dd661c5e252469 Other: Tools and scripts
SHA256 fa317b071da64e3ee18d82d3a6a216596f2b4bca5f4d3277a091a137d6a21c45 Other: Tools and scripts
From the article:
This includes a team led by Professor David Basin, head of the Information Security Group at ETH Zürich and one of the inventors of Tamarin — a leading security protocol verification tool that was also used to evaluate PQ3 — as well as Professor Douglas Stebila from the University of Waterloo, who has performed extensive research on post-quantum security for internet protocols.
There is a paper describing the tests.
Not that this settle everything.
Do you mean the text accompanying the post? That is the first two paragraphs from the article.
The “better summary” I posted later was actually generated by chatgpt.
A better summary:
The text discusses a series of cybersecurity breaches affecting Microsoft, involving sensitive data theft from US government officials and organizations, attributed to Chinese hackers. Microsoft’s delayed response to discovered security flaws, including a 90-day wait for a partial fix, is criticized. Senator Ron Wyden has called for Microsoft’s accountability. The breaches underscore the growing issue of security vulnerabilities in tech companies, leading to expectations that the US government will require companies to promptly disclose security incidents within a strict timeframe.
IoCs available in the original article.